Poison Attacks 101 - UCS Blog Article

Poison Attacks 101

Smart technology is everywhere. Not just in our offices, but even in our day-to-day lives with tools like Google Home and Alexa becoming a commonplace. With technology becoming smarter every minute, the risks are increasing by the minute as well. Cyber-criminals are finding new ways to corrupt our IT networks to disrupt our businesses, hold our data hostage and even clear out personal bank accounts. Some of the more overt, commonly known acts of cyber-crime include hacking, phishing, and ransomware attacks. This article discusses a lesser-known cyber-crime. Let's take a look at Poison Attacks 101.

What Are Poison Attacks

Poison attacks are attacks on the ability of a system to make smart decisions. Think about this for a second. How do systems make intelligent decisions? Based on the training or data they receive. This data is used to hone the artificial intelligence of the system to help make smart decisions. Poison attacks mess with the very base layer – the training data set - by skewing the system’s data model in such a way that the output is no longer as intended. They create a new normal for everything and are primarily used as a backdoor attack method. In a backdoor poison attack, the attacker creates a loophole in the core data rule and trains the system to adhere to that rule so it can be exploited at a later time.

For example, let’s say the access control for a particular file is set such that it will allow only those beyond the VP level to view the data. If someone changes the main parameter to include manager level access, the core data set is violated and the system will not detect an intrusion by someone at the manager level, even if they log in with their credentials.

Poison Attack Methodologies

Poison attack methodologies typically fall into one of the following 4 categories:

    • Logic Corruption
    • Data Manipulation
    • Data Injection
    • DNS Cache Poisoning

Logic Corruption

In Logic Corruption, the attacker changes the basic logic used to make the system arrive at an output. It essentially changes the way the system learns, applies new rules and corrupts the system to do whatever the attacker wants.

Data Manipulation

In Data Manipulation, as the name suggests, the attacker manipulates the data to extend data boundaries that result in backdoor entries that can be exploited later. Unlike Logic Corruption, the attacker doesn’t have access to the logic, so they work with the existing rule and push data boundaries further with a view to accommodate them later.

Data Injection

In Data Injection, the attacker inserts fake data into the actual data set to skew the data model and ultimately weaken the outcome. The weakened outcome then serves as an easy entryway for the attacker into the victim’s system.

Protecting Yourself Against Poison Attacks

Data poisoning by way of logic corruption, data manipulation and data injection happens when the attacker finds a way to access your data set. The kind of poison attack varies depending on the level of access the attacker is able to achieve. Here’s what you can do to ensure such access is prevented:

  1. The data poisoning attacks discussed above adversely affect your IT system’s machine learning capabilities. So, the first logical step would be to invest in a good machine learning malware detection tool. These tools are different from the typical anti-malware tools you get in the market and are specifically designed to prevent machine learning capability poisoning.
  2. Always follow general IT security best practices such as:
    • Training your employees to identify spam, phishing attempts, and possible malware attacks.
    • Following good password hygiene, which means never sharing passwords and only using passwords that meet the required security standards.
    • Having a powerful IT audit process, tracking and version control tools, so as to thwart any possible insider attack.
    • Ensuring the physical security of your IT systems by way of bio-metric access, CCTV systems, etc.

DNS Cache Poisoning

In one of the most common poisoning attacks, the attacker poisons the DNS Cache with the aim of leading visitors to a fake website. In a DNS cache poisoning case, the attacker gains control of the DNS server and then manipulates cache data such that anyone typing the URL of the actual website is redirected to the fake one. This could be a phishing site where the attacker would have carefully laid out a trap to capture the unsuspecting victim’s personal data or secure information. For example, the visitor thinks they are logging into their bank’s website online, but are actually on the attacker’s phishing site, where they enter the login credentials.

Protecting Yourself Against DNS Cache Poisoning Attacks

As discussed before, one of the most common poisoning attacks are DNS attacks. You can prevent this by bringing a trained professional onboard for your DNS server set-up. An expert will know to set up your DNS server such that it has a minimum relationship with other, external DNS servers, thus limiting your attacker’s ability to corrupt your DNS server using theirs.

As a best practice, ensure that your DNS servers only store data related to your domain and not any other information. It is harder to corrupt the system when it focuses on a single element.

Another best practice is to ensure that you are up-to-date on all DNS security mechanisms and are using the most recent version of the DNS.

Ensure your site has an SSL certificate and is using HTTPS protocol. Using encryption, a site with HTTPS protocol allows for a more secure connection between its server and the internet and is better at keeping cyber-criminals out. Have an SSL certificate also ensures your site’s name shows up alongside the URL in the address bar. This is an easy way for visitors to identify if they are on a genuine site or not, thus helping them steer clear of phishing attacks and clone sites.

Data poisoning is one of the lesser-known and hence less talked about forms of cyber-crime. But, it can inflict great damage – perhaps even more damage than the other obvious threats such as viruses and ransomware, because, unlike a Denial of Service (DDoS) attack or a Ransomware attack where you know the moment the malware has hit your system, in a data poisoning attack, the malware is incorrect data that slithers into your system quietly and changes its overall functioning before delivering the big blow.

Preventing attacks on your data and infrastructure is where Unique Computing Solutions specializes with comprehensive Managed Security Service packages an a complete team of professionally educated technicians to back it all up. Give us a call today to see how we can help improve your security from day one: 708-922-9444


Employees and Cybersecurity - UCS Blog Article

Employees and Cybersecurity

For any organization, employees are the biggest asset. But, what happens when your biggest assets also turn out to be your greatest threats and liabilities? Let's take a moment to talk about Employees and Cybersecurity. That is, after all, how cyber-crime can change the game.

Read more


SMB Security Tips - Our Top 7 - UCS Blog Article

SMB Security Tips - Our Top 7

A massive global shift to remote working environments has created an open-season for cybercriminals. No business - big or small - is safe. Small and medium businesses (SMBs) seemingly have a target on their backs, so strengthening your company's security posture is essential right now. This process doesn't have to be stressful or time consuming. There are simple ways to protect business data against ransomware attacks right away and long term solutions to help your business boost resilience to cyber attacks. Here are a few of our top SMB security tips and suggestions:

Read more


Windows Feature Updates - What, Why, How?

Over the past few years Microsoft has worked heavily on creating a new style of Windows OS that is packed full of features, applications and optimizations that have helped countless number of organizations and users transition into the modern, technology driven environment we all experience today. We’ve all seen the ads on TV, or the stickers on devices when you walk into an electronics store, and it’s likely that the most significant of these upgrades you have experienced in recent years was the move from Windows 7/8 to Windows 10.

Read more


Data Security And Risk

We hear a lot of talk about data security because of the constant threat of cyber attacks and hacking. News of data breaches are now a common occurrence in our daily life. As a result, we are exceptionally concerned about the branding and reputation consequences of a data breach. However, there are other events which could occur that make your data inaccessible. It is important to know you are doing the best you can to protect against cyber attacks, ransomware and other forms of data theft, but data security goes beyond that.

Read more


Do You Really Need Online Data Backups?

If you are like most SMBs, you are probably thinking of online data backups as a cost addition. You probably don't have too many systems and you have a handful of trusted employees who know their job pretty well. Why do you need to invest in online data backups? Why should you worry about data loss?

Read more


Gain Customer Loyalty By Minimizing Downtime

Small business has changed dramatically within the last decade. No change has been more profound than our dependency on information technology (IT) systems to support critical day-to-day business functions.Read more


The Importance Of Cyber Resilience

According to the National Cyber Security Alliance study, 60% of businesses that are hacked go out of business within six months. The vast majority of damage done in cyber attacks is due to the inability of the company to respond because they have not developed a cyber prevention and response strategy.

Read more


CEO? Here's Why You Care About Business Continuity

As a proactive CEO, you know that implementing a solid business continuity and disaster recovery plan, also referred to as BCDR, is essential for your business. After all, why would anyone in your esteemed position ever put a business at risk to downtime or data loss when prevention is so easy?

Read more


Ransomware: 6 Ways We Can Shield Your Business

As your business becomes increasingly more digital, you're using more systems and running more applications to manage day-to-day operations, share critical information and complete vital tasks. All of these different devices, back-end systems and applications generate and exchange an overwhelming amount of data and this will only continue to increase.

Read more